G1 point exceeding modulus

[consensys]

G1 point exceeding modulus

[ThomasPiellard]

Hi @holiman , so the scalar that you have is in fact a multiple of r, the group order of bls12-381. So the result of the scalar multiplication is the point at infinity, encoded as [0,0]. gnark-crypto and geth use a different encoding for the point at infinity in affine, for geth it's [0,0], for gnark-crypto it's 0x40 << 760, so it's indeed bigger than bls12-381's field of definition. The reason for our way of serializing is to match ZCash and IETF encoding.

[gbotrel]

To give more context on this one;

1. We did investigate and found no bug on our side related to either the ScalarMul or the [de]serialization.
2. As for the encoding differences, we follow the latest IETF draft, and Ethereum 2.0 (through the use of supranational/blst) does too. In particular:

The most-significant three bits of a G1 or G2 encoding should be masked away before the coordinate(s) are interpreted. These bits are used to unambiguously represent the underlying element:

...
The second-most significant bit indicates that the point is at infinity. If this bit is set, the remaining bits of the group element's encoding should be set to zero.